Network‑AI’s MCP SSE server, when running with its default configuration, assigns an empty string to the secret used for authentication. Consequently, the `_isAuthorized` routine always returns true, so any request lacking an Authorization header is accepted. Additionally, each response includes Access‑Control‑Allow‑Origin: *, allowing any cross‑origin browser fetch to read the data. An unauthenticated attacker who lures a user to a malicious web page can then invoke all 22 exposed MCP tools — such as config_set, agent_spawn, and blackboard_write — against the localhost instance. The attacker can therefore modify configuration, spawn new agents, or write arbitrary data to the blackboard, leading to privileged operations on the host and compromising confidentiality, integrity, and availability.

Jovancoding’s Network‑AI application in all releases before version 5.4.5. The vulnerability arises when the environment variable NETWORK_AI_MCP_SECRET is unset or empty, which is the default for these earlier releases.

The vulnerability has a CVSS score of 7.6, indicating high severity, and an EPSS score of < 1 %, suggesting that although the probability of exploitation is low, it remains possible. The flaw is not yet listed in CISA’s KEV catalog. Attackers can exploit the issue from a local context without authentication by loading a malicious webpage that targets the running Network‑AI instance; the lack of an Authorization check combined with the unrestricted CORS setting makes crafting and delivering the attack straightforward. The flaw is rooted in CWE‑346, reflecting an insecure unchecked secret.